The Microsoft Graph Mail Driver allows to send email through the Microsoft Graph API using OAuth 2.0 client credentials. This driver uses application permissions instead of delegated user permissions, so it does not require browser authorization, refresh tokens, stored tokens, or the Authorize Account flow.
Unlike the Office 365 SMTP implementation, which authenticates through SMTP, the Microsoft Graph Mail Driver sends email through the Microsoft Graph sendMail endpoint.
Configure Office 365 Mailer Driver Settings
Permissions
Your user account or group membership must have the "Settings: Update Settings" permission to edit email server settings unless your user account has the Make this user a Super Admin setting selected.
See the Settings permissions or ask your Administrator for assistance.
Enable Office 365 SMTP OAuth in Email Server Settings
Follow these steps to enable SMTP authentication for the Office 365 email server settings. Create a new email server configuration. Email server settings display.
Configuration | Value |
|---|---|
Mail Driver | Microsoft Graph |
Authentication | OAuth Client Credentials |
Permission Type | Application |
Transport | Microsoft Graph REST API |
Refresh Tokens | No |
Authorization Account | Not required |
Validation | Send test email |
Required Configuration
When the Microsoft Graph driver is selected, configure the following settings:
Setting | Description |
|---|---|
Tenant ID | Microsoft Entra tenant ID used to request the access token. |
Client ID | Application client ID from the Microsoft Entra app registration. |
Client Secret | Application client secret used with the client credentials flow. |
Sender Email | Mailbox address used to send email through Microsoft Graph. |
Sender Name | Display name used for outgoing messages. |
These values are loaded into the runtime configuration before email is sent.
Required Microsoft Entra Configuration
Before using Microsoft Graph as a mail driver, register an application in Microsoft Entra ID and configure the required application permissions.
The application must have the following Microsoft Graph permission:
Microsoft Graph Permission | Type | Required | Purpose |
|---|---|---|---|
| Application | Yes | Allows the application to send email through Microsoft Graph without a signed-in user. |
No delegated permissions are required because the driver uses the OAuth 2.0 Client Credentials flow.
Authentication Behavior
The Microsoft Graph Mail Driver uses the OAuth 2.0 Client Credentials flow. Before sending an email, ProcessMaker requests an access token from Microsoft using the configured Tenant ID, Client ID, and Client Secret.
Because this is application authentication:
No browser authorization is required.
No refresh tokens are issued.
No tokens are stored in ProcessMaker.
A new access token is requested each time an email is sent.
If required credentials are missing, delivery stops before the email is sent.
Sending Email
Email delivery uses the same entry points as other mail drivers, including process execution through SendEmail and the existing test email function.
When an email is sent, the Microsoft Graph transport:
Requests an OAuth access token.
Converts the email into the Microsoft Graph
sendMailpayload.Sends the request to:
POST /v1.0/users/{senderEmail}/sendMailAny non-success response from Microsoft Graph results in a transport error.
Message Conversion
The Send Email connector builds a standard email message, and the Microsoft Graph transport converts that message into the JSON format required by Microsoft Graph.
The conversion includes:
Subject
HTML or text body
To recipients
CC recipients
BCC recipients
Attachments
Attachments are converted into Microsoft Graph fileAttachment objects. Because Microsoft Graph expects attachments to be included in the JSON request using Base64-encoded raw bytes, attachment content is taken from the attachment body before encoding.
Test Email Validation
Use Send Test Email to validate the Microsoft Graph configuration. Unlike Office 365 SMTP, there is no authorization step.
A successful test email confirms that:
Azure credentials are valid.
Application permissions have been granted.
The sender mailbox exists.
The application is allowed to send mail as the configured mailbox.